Publishing & sharing
Apps that store their own data
Section titled “Apps that store their own data”Some apps need to keep things: a vacation tracker, a signup list, a small tracker. The
platform can give an app its own database, its tables, and per-row ownership. Claude uses
provision_app to create the serverless database, groups, contained users, row-level
security, and registered entities. Apps that only read data Ops has already exposed do
not need this step; see Building on exposed data.
Publish
Section titled “Publish”In your Claude session, when the app looks right:
You: Share this solution as “quarterly-dashboard”.
For every publish, Claude prepares and sends two compressed archives - your project source
and the built bundle the gateway will serve - then waits for the platform to verify and
activate them. Both archives are required, and project files are never copied into a base64
tool request. The bundled publish helper uploads resumable 4 MiB blocks through the single
transfer.apps.<yourdomain> host, using a separate 15-minute token for each archive. On the
first publish for a new name, begin_publish creates the app record
while reserving the first version. complete_publish activates the version only after
verifying both archives; it also durably retains the source archive alongside the version
after a blocking secret scan. Suspected secrets reject the reserved version before source
promotion or bundle activation. Remove the flagged material, prepare both archives again,
and begin a new version. A temporary scanner failure does not reject the reservation, so
Claude retries completion with the same bytes. Every accepted version can be picked back up
later. There is nothing to
configure per app and no Entra registration to set up. Once Ops has configured the public apps
domain, the successful completion response includes the app’s canonical HTTPS URL, which Claude
reports back directly.
Task-aware MCP clients can let complete_publish continue after the original request returns and
poll its task handle for up to 15 minutes. Older clients wait for the same result inline. Do not
start another completion while the task is still working. Task cancellation does not undo work
that already reached the platform.
If a temporary storage error interrupts verification, Claude retries completion for the same
reserved version; an expired 15-minute upload grant requires preparing and beginning again.
Only you can open it - the gateway checks group membership before serving a single byte,
and until you share, you’re the only member.
Because the source is retained per version, you can resume an app in a fresh Claude session:
ask Claude to fetch the app’s source (get_app_source), which streams through the same
transfer host and resumes interrupted downloads, then edit and republish. Versions
published before source retention existed have no retained source and say so clearly.
Re-publishing with the same name updates the same app (a new immutable version, pointer flipped live, instant rollback if a change goes wrong); use a new name only for a genuinely new app. Rollback can select only a version that previously completed activation; pending or failed uploads never become rollback targets.
App lists, status checks, successful publishes, and rollbacks include the same canonical URL whenever an app has an active version and the public apps domain is configured. Draft apps and installations without public app DNS do not advertise a URL.
You: Share it with the Sales Analytics team.
This creates a request your Ops team approves, usually quickly, because they’re only deciding audience, not data access (viewers can never see data their own permissions don’t allow). You’ll see the request id. Once approved, the group’s members can sign in.
What your teammates experience
Section titled “What your teammates experience”They open the URL, sign in with their normal work account, and use the app. If it shows corporate data, each person sees their own slice: same app, different data, correct by construction.